github.com/chainguard-dev/kaniko vulnerabilities (Go)

2 vulnerabilities.

• github.com/chainguard-dev/kaniko Go kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts CVE-2026-105769 Fix available 9.3 CriticalNovember 2, 2026
• github.com/chainguard-dev/kaniko Go kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory CVE-2026-28406 Fix available 8.2 HighFebruary 27, 2026